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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF FLORIDA 


IRA KLEIMAN, as the personal representative CASE NO.: 9:18-cv-80176-BB 
of the Estate of David Kleiman, and W&K Info 
Defense 
Research, LLC, 

Plaintiffs, 


Vv. 


CRAIG WRIGHT, 





Defendant. 





SUPPLEMENTAL AFFIDAVIT OF DR. MATTHEW J. EDMAN 
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I, Dr. Matthew J. Edman, declare under penalty of perjury, as follows: 


I. SUMMARY OF OPINION 


1. In my previous affidavit (ECF No. [159-9]) that I submitted in response to 
Defendant’s Motion for Judgment on the Pleadings (ECF No. [144-1]), I determined that Exhibit 
A to that Motion (ECF No. [144-1], hereafter referred to as “Exhibit A”) was likely created from 
an email the Defendant sent to himself on or about April 16, 2014 (UTC), which was then 
converted to a PDF and modified to appear to have been sent from “Dave Klieman (sic)” to Uyen 
Nguyen on or about December 20, 2012. I also determined that Exhibit A contained a PGP 
signature allegedly created by Dave Kleiman on or about March 12, 2014 — almost a year after he 
died. 

2. Since the submission of my previous affidavit, I have conducted further analysis of 
Exhibit A and identified additional forensic artifacts contained within the PDF itself that support 
my previous opinion. I have also conducted a forensic analysis of Exhibit F to Defendant’s Motion 
for Judgment on the Pleadings (ECF No. [144-6], hereafter referred to as “Exhibit F”) and 
determined that it was created by further modifying Exhibit A to make it appear as if Exhibit F is 
actually a separate email sent from Dave Kleiman to Uyen Nguyen, when, in my opinion, it is 
simply another revision to the PDF created from an email the Defendant sent to himself on or about 
April 16, 2014.! 

a In sum, Exhibit A and Exhibit F, which appear to be emails sent from Dave Kleiman 
to Uyen Nguyen on December 20, 2012, are manipulations of a PDF created from an email the 


Defendant sent from himself to himself on or about April 16, 2014. 


'T understand Exhibit A was subsequently withdrawn by the Defendant “because he cannot verify 
the date of that email exchange.” To my knowledge, Exhibit F has not been withdrawn by the 
Defendant. 
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I. EXHIBIT A 


4. As described in my previous affidavit, Exhibit A is a PDF document that purports 
to be an email sent from “Dave Klieman (sic)” to Uyen Nguyen on or about 8:19:03 AM on 
Thursday, December 20, 2012. The metadata associated with the PDF, however, indicates the 
PDF was created on or about April 17, 2014 at 8:23:41 AM using Acrobat PDFMaker 11 for 
Microsoft Outlook on a computer whose time zone was consistent with Sydney, Australia 
(UTC+10), and then modified less than five minutes later. I have further analyzed the internal 
contents and structure of the PDF, and have now identified those specific portions of the PDF that 
were edited after the PDF was created. 

5. In general, when the text within a PDF document is modified using Adobe Acrobat, 
the software automatically adds a “marked-content point” (indicated by an “MP” operator in the 
PDF’s internal document structure) and is labeled “TouchUp_ TextEdit” to indicate the marked- 
content point was created using Adobe Acrobat’s “Touch Up” text editing feature. The modified 
text is also often represented using a sequence of 4-digit “codes,” each of which is mapped to a 
particular character to display in a PDF reader. For example, in the PDF associated with Exhibit 
A, the 4-digit code “0027” corresponds to an uppercase “D”’. 

6. I identified a “TouchUp_ TextEdit” marked-content point in the PDF file associated 
with Exhibit A which indicated that the text associated with the “From:”, “To:’, and ““Date:” fields 
at the top of Exhibit A were edited. Figure 1 shows an excerpt from the internal structure of Exhibit 
A with line numbers added for reference. Line | shows the “TouchUp_ TextEdit” marked-content 
point, which indicates that what follows has been modified. The text highlighted in red on Lines 
6, 8, 17, 21, and 27 contain the modified text. Figure 2 provides a screenshot of how the 


corresponding text object appears in a PDF reader, with the modified characters highlighted in red. 
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FIGURE 1. Excerpt from the source code contained within Exhibit A indicating where changes were made in 
the header for Exhibit A (highlighted in red). 





1. /TouchUp_TextEdit MP 

2. BT 

3. /CS1 cs @@1 = scn 

4. /C2_0 7.5 Tf 

5a 155.85 771.598 Td 

6. Tj 

7. @ -10.5 TD 

* Sfeeukoossooscooss00s1005yee73003Coosseosb003200s20eTIe04600S200500000> 
Ti 

9. /CS@ cs @ scn 

10. /TT1 7.5 Tf 

11. I* 

12. (Apppointment letter)Tj 

13. T* 

14. (Thursday, )Tj 

15. /C2_0 7.5 Tf 

16. 35.226 @ Td 

17. (GRSeRSST j 

18. /TT1 7.5 Tf 

19. ( )Tj 

20. /C2_0 7.5 Tf 

21.  <@0270048004600480050004500480055>T j 

22. /TT1 7.5 Tf 

23. 44.07 @ Td 

24. ( 201)Tj 

25. /C2_0 7.5 Tf 

26. 14.626 © Td 

27. (@aaT 5 

28. /TT1 7.5 Tf 

29. ( 8:19:03 AM)Tj 

30. ET 





FIGURE 2. Screenshot of the rendered text object from Figure 1 with the corresponding text modifications again 
highlighted in red. 


From: Dave Klieman 


To: Uyen Nguyen (uyen.nguyent@yahoo.com) 


Subject: Apppointment letter 
Date: Thursday, 20 December 2012 8:19:03 AM 
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Il. EXHIBIT F 

Te Exhibit F is alleged by the Defendant to be a second email from “Dave Klieman 
(sic)” to Uyen Nguyen sent less than an hour after Exhibit A in which Dave is purportedly thanking 
Nguyen for accepting a position as director of W&K Info Defense Research LLC. 

8. The version of Exhibit F filed by the Defendant does not bear a Bates label. 
DEF _00027288 was produced in this litigation by the Defendant and is visually identical to Exhibit 
F. I used the PDF file produced as DEF 00027288 in my analysis below. 

9. I determined that Exhibit F is a derivative of Exhibit A — which itself was based on 
an email sent from the Defendant to himself. Further, I have determined that Exhibit F contains 
additional modifications to the “Date:” field, as well as modifications to the body of the alleged 
email itself. 

10. As described in my previous affidavit, PDF files often contain metadata which 
provide information about the document, such as who created it and when, as well as when it was 
last modified. The metadata contained within the PDF files associated with Exhibit A and Exhibit 
F also contain “DocumentID” and “InstanceID” attributes. “DocumentID” is an identifier used to 
associate multiple versions or revisions of a particular document, whereas “InstanceID” is a unique 
identifier assigned to a specific version or revision of that document. 

ine As shown in Figures 3 and 4, Exhibit A and Exhibit F contain the same 
DocumentID but different InstanceID values, which indicates that they are both versions of the 
same original document. The metadata further shows that Exhibit A and Exhibit F were both 
created on the exact same date (as shown by the CreateDate fields), but the ModifyDate fields 
indicate that someone modified Exhibit F approximately five minutes after Exhibit A was last 


modified. 
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FIGURE 4. PDF metadata extracted from Exhibit A. 


1 @ obj 
<</Length 3320/Subtype/XML/Type/Metadata>>stream 
<?xpacket begin="iI»¢" id="W5M@MpCehiHzreSzNTczkc9d" ?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.4-c005 78.147326, 2012/08/23 -13:03:03 
"> 
<rdf:RDF xmlns:rdf="http: //www.w3.org/1999/02/22-rdf-syntax-ns#"> 
<rdf:Description rdf:about="" 
xmlns:xmp="http://ns.adobe.com/xap/1.0/" 
xm1ns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" 
xmlns:dc="http://purl.org/dc/elements/1.1/" 
xmlns:pdf="http://ns.adobe. com/pdf/1.3/"> 
<xmp :ModifyDate>2014-04-17T8 : 28:@1+10:00</xmp:ModifyDate> 
<xmp:CreateDate>2014-04-17T08 : 23:41+10: 00</xmp: CreateDate> 
<xmp :MetadataDate>2014-04-17T@8: 28 :01+10: 00</xmp:MetadataDate> 
<xmp:CreatorTool>Acrobat PDFMaker 11 for Microsoft Outlook</xmp:CreatorTool> 
<xmpMM : Document ID>uuid :6a5e8226-043f-4de4 - 8879 -3£41e143b0c3</xmpMM:DocumentID> 
<xmpMM: InstanceID>uuid : 42c69e4F - 6d@6 - 4166 - bc FF -52c26160a0e9< /xmpMM: InstanceID> 
<dc: format>application/pdf</dc:format> 
<dc:title> 
<rdf:Alt> 
<rdf:1i xml: lang="x-default"/> 
</rdf:Alt> 
</dc:title> 
<pdf:Producer>Adobe PDF Library 11.0</pdf:Producer> 
</rdf:Description> 
</rdf:RDF> 
</x:xmpmeta> 





FIGURE 3. PDF metadata extracted from Exhibit F. 


2 @ obj 
<</Length 3320/Subtype/XML/Type/Metadata>>stream 
<?xpacket begin="i»¢" id="W5M@MpCehiHzreSzNTczkc9d" ?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.4-c005 78.147326, 2012/08/23 -13:03:03 
"> 
<rdf:RDF xmlns:rdf="http: //www.w3.org/1999/02/22-rdf-syntax-ns#"> 
<rdf:Description rdf:about="" 
xmlns:xmp="http://ns.adobe.com/xap/1.0/" 
xm1ns:xmpMM="http://ns.adobe.com/xap/1.@/mm/" 
xmlns:dc="http://purl.org/dc/elements/1.1/" 
xmlns:pdf="http://ns.adobe.com/pdf/1.3/"> 
<xmp :ModifyDate>2014-04-17T@8 : 33:16+10:00</xmp:ModifyDate> 
<xmp:CreateDate>2014-04-17T08: 23:41+10: 00</xmp: CreateDate> 
<xmp :MetadataDate>2014-04-17T@8: 33:16+10:00</xmp:MetadataDate> 
<xmp:CreatorTool>Acrobat PDFMaker 11 for Microsoft Outlook</xmp:CreatorTool> 
<xmpMM : Document ID>uuid :6a5e8226-043f -4de4-8879-3£41e143b0c3</xmpMM:DocumentID> 
<xmpMM: InstanceID>uuid : b2815a@5 -9c27-40fc -aQ@85 -140c7633e45a</xmpMM: InstanceID> 
<dc: format>application/pdf</dc:format> 
<dc:title> 
<rdf:Alt> 
<rdf:1i xml: lang="x-default"/> 
</rdf:Alt> 
</dc:title> 
<pdf:Producer>Adobe PDF Library 11.0</pdf:Producer> 
</rdf:Description> 
</rdf:RDF> 
</x:xmpmeta> 
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12. I compared the edits made in Exhibit F to those previously made in Exhibit A and 
determined that the “Date:” field was modified to make it appear as if it were sent less than an 
hour after Exhibit A was allegedly sent. Figure 5 highlights in blue the “new” modifications made 
in Exhibit F. Figure 6 shows how that modified email header field appears in a PDF reader while 
also highlighting all the edits made to the email header field. In addition to the edits shown in 
Figure 5 and Figure 6, the data contained within the PDF file associated with Exhibit F also 


indicates that the body of the email was altered from the body of the email contained in Exhibit A. 
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FIGURE 5. Excerpt from the source code contained within Exhibit F showing a PDF text object which 
contains modifications. The modifications made previously in Exhibit A are highlighted in red. The edits 
subsequently made in Exhibit F are highlighted in blue. 


BT 

/CS1 cs @@1 scn 
/C2_0 7.5 Tf 
155.85 771.598 Td 


@ -10.5 TD 


/C2_1 7.5 Tf 

140.533 @ Td 

LEST j 

/CS@ cs @ scn 

/TT1 7.5 Tf 

-140.533 -10.5 Td 

(Apppointment letter)Tj 

-@.009 Tw T* 

(Thursday, )Tj 

/C2_0 7.5 Tf 

6 Tw1001 191.076 740.098 Tm 
T5 

/TT1 7.5 Tf 

is) 

/C2_0 7.5 Tf 


CONDUBWNHE 


/TT1 7.5 Tf 
@.008 Tw 44.07 @ Td 
( 201)Tj 
/C2_0 7.5 Tf 
@ Tw 14.626 @ Td 
5 
/TT1 7.5 Tf 
( )Tj 
/C2_1 7.5 Tf 
FERNS 
/TT1 7.5 Tf 
Gaya 
/C2_1 7.5 Tf 
17.278 ®@ Td 
EEERUSST j 
/TT1 7.5 Tf 
(Oi 
/C2_1 7.5 Tf 
00140017 >)p 
/TT1 7.5 Tf 
( AM)T 
ET 
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FIGURE 6. Screenshot of the rendered text object from Figure 5 with the text modifications 
from Exhibit A highlighted in red and the subsequent modifications made in Exhibit F 








highlighted in blue. 
From: Dave Klieman 
To: Uyen Nguyen (uyen.nguyent@yahoo.com) 
Subject: Apppointment letter 
Date: Thursday, 20 December 2012 9:11:14 AM 


Dated: July 9, 2019 


Bon 


Dr. Matthew J. Edman 
Miami, Florida 


